Policy on the processing of personal data CLIENTS AND SUPPLIERS

CLIENTS AND SUPPLIERS INFORMATION ALSO ON TRANSPARENCY ON AUTOMATED DECISION-MAKING SYSTEMS

Artt. 5-6-7-12-13 of the UE Regulation n. 679/2016

art. 1-bis D.Lgs. 152/1997 and Italian law 132/2025

Last update: May 06th 2026

NOTICES AND CONTACT DETAILS OF THE DATA CONTROLLER EX ART.13 of the UE Regulation  n. 679/2016

Controller
Metaltronica S.p.A.
with registered office in Via delle Monachelle, 66 70- 00071 Pomezia (Rome) – Italy, VAT no. 01123731000

Contact details of the Controller

Tel: +39.06.66160206
Fax: +39.06.66160357
Mail: privacy@metaltronica.com

Contact details of the Data Protection Officer

Not applicable as per Article 37 of the UE Reg. n.. 679/2016

Metaltronica S.p.A interacts, inter alia, with legal entities, as professional economic operators in the business sector.
This notice is addressed to legal persons and natural persons acting on their behalf, to which the definition of “personal data” refers.
As per at.4 of the GDPR:
(1) ‘personal data’ means any information relating to an identified or identifiable natural person (‘data subject’); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person.
This notice is published on the Data Controller’s website www.metaltronica.com for direct access by interested parties.

Metaltronica S.p.A with registered office in Via delle Monachelle, 66 -70 00071 Pomezia (RM) – Italy, VAT No. 01123731000, as Data Controller of Your personal data, hereby informs You, pursuant to articles 12 and 13 of EU Regulation no. 679/2016 (General Data Protection Regulation, hereinafter referred to as “GDPR”), that Your personal data will be processed as follows:

OBJECT OF PROCESSING

The Controller collects Personal Data in compliance with all applicable data protection laws and regulations, including, without limitation, the GDPR.

The personal data of the clients and of the suppliers are acquired directly from the interested party or collected through legitimate channels such as public databases, databases of the business affiliates group, business cards, contact requests via email/web and are processed for management purposes. of commercial contacts aimed at stipulating purchase/sales/supply contracts.

The data is of a common nature – such as, but not limited to, name, surname, company role, tax, postal, e-mail, banking and accounting data, telephone contacts as well as economic data necessary for carrying out contractual relationships or fulfilling obligations. pre-contractual, contractual and fiscal deriving from the relationships themselves.

PURPOSE OF PROCESSING

The processing operations are addressed at the performance of activities related to the stipulation and execution of bids/quotations/contracts/orders for the supply of goods and services and professional services and/or the conferment of the related appointments and mandates, the subsequent management of administrative, accounting, fiscal, technical customer/supplier management as well as the fulfillment of obligations under laws, regulations and EU legislation, as well as provisions issued by authorities empowered to do so by law and by supervisory and control bodies, and for any other needs related to the requirements of the contractual relationship even after its conclusion, such as for the defense of a right or for legal obligations.

LEGAL BASIS

The processing of Personal Data, for the purposes set out above does not require your consent as such processing is necessary to execute the pre-contractual measures/contractual relationship agreed with you and to enable the mutual fulfillment of the obligations arising therefrom, as well as to enable the Controller to fulfill legal obligations and/or the pursuit of the legitimate interest in carrying out its business activities.

More specifically:

– in the event that the supplier or the client  is a natural person:

by the need to perform the contract, in compliance with Article 6(1)(b) GDPR; and/or the need to fulfill legal obligations, in compliance with Article 6(1)(c) GDPR;

– in the event that the supplier or the client is a legal person from the legitimate interest of the Controller to process the personal data of the employees, managers, contact persons or directors of the supplier or customer legal person for the purpose of the performance of the supply contract signed with them, in compliance with Article 6(1)(f) GDPR.

MODALITY OF PROCESSING

Processing of Your personal data disclosed by You is carried out by means of the operations as per Article 4 of the GDPR and, more specifically: “collection, recording, organization, storage, consultation, processing, modification, selection, extraction, comparison, use, interconnection, communication, erasure and destruction of data”.

The personal data You disclose will be processed in paper, electronic and computerized form and included in the relevant personal data and databases (customers, users) for the time strictly necessary to achieve the purposes for which they were collected, with technical and organizational methods, adopted to prevent the loss of data, illegal or incorrect use and unauthorized access, and such, therefore, to ensure a level of security appropriate to the risk under Article 32 of GDPR 2016/679, by persons specifically authorized to do so, in compliance with the provisions of Article 29 of GDPR 2016/679, or employees and/or coworkers of Metaltronica S.p.A. in their capacity as authorized persons and/or internal delegated representatives and/or system administrators, who may carry out operations of consultation, use, processing, comparison and any other appropriate operation, including automated operations, in compliance with the provisions of the law necessary to guarantee, among other things, the confidentiality and security of data as well as the accuracy, updating and pertinence of data in accordance with the declared purposes and methods.

The list of authorized/referred/responsible persons can be obtained from the Controller .

DISSEMINATION

Your personal data will not be sold or disclosed except:

• As required or permitted by applicable law or legal process

• to law enforcement or other public officials in accordance with a legitimate legal request;

• to establish, exercise or defend legal claims;

• in connection with investigations of suspected or actual fraud or illegal activities; or

• otherwise with the user’s consent.

Within the scope of the legitimate interest The Data Controller shares the data of the client/supplier with its corporate business group , for the purposes of the present notice.

Your data may be communicated to subjects and/or categories of subjects both in Italy and outsided, who provide services, including external, on behalf of the Data Controller, duly authorised, such as but not limited to: entities that carry out, auxiliary purposes to the execution of contractual commercial relationships, or subsidiaries, parent companies or otherwise connected to the Company for purposes other than administrative-accounting and commercial, postal services and courier and delivery agencies, business partners, banking and insurance institutions, public administrations and supervisory and audit authorities, law firms and notaries, auditing firms, debt collection firms, service centers, companies or consultants charged with providing specific professional and consulting services to Metaltronica S.p.A., or third parties that provide IT services (e.g. hosting or IT maintenance and support services).

DATA TRANSFER TO COUNTRIES OUTSIDE THE EU

Your personal data are stored within the territory of the European Union. It is understood in any case that the Data Controller, should it become necessary to transfer the data outside the EU territory – for example, in the case of using Cloud services – assures you as of now that the transfer will take place in accordance with the applicable legal provisions, subject to the stipulation of the standard contractual clauses provided by the European Commission.

STORAGE
In accordance with the principles of lawfulness, limitation of purposes and storage and minimization of data, pursuant to Article 5 GDPR 2016/679, , the storage period of Your personal data is set for a period of time no longer than the achievement of the purposes for which they are collected and processed, or for the duration of the purchase/supply contract and in any case for a term not longer that 10 years following the conclusion of the contractual commercial relation, except legal and fiscal justifications.

AUTOMATED DECISION MAKING AND PROFILING

Metaltronica S.p.A. hereby informs You that it does not use automated decision-making processes, or those designed to make decisions based solely on technological means according to predetermined criteria (i.e. without human involvement), nor does it carry out profiling activities, or use Your personal data to analyze or predict aspects relating to professional performance, financial situation, health, personal preferences, interests, reliability, behavior, location or travel, etc.

TRANSPARENCY ON AUTOMATED DECISION-MAKING SYSTEMS (ART. 1-BIS LEGISLATIVE DECREE 152/1997 AND LAW 132/2025)

Metaltronica, in accordance with Italian current legislation and the provisions of Legislative Decree 152/1997 (as amended by Legislative Decree 104/2022 and Law 132/2025), informs that, as of today:

Absence of Automated AI Systems:

In managing relationships with clients and suppliers, the company does not use fully automated decision-making or monitoring systems based on artificial intelligence (AI).

Human Supervision:

All decisions regarding the management of contractual relationships are made and verified directly by human managers, in compliance with the principles of fairness and transparency.

Commitment to Transparency:

Should the company decide to introduce future AI-based systems, it will provide timely and specific written information to all interested parties, in accordance with applicable legislation.

RIGHTS OF THE DATA SUBJECT

We inform you that as a data subject you have -in addition to the right to lodge a complaint with the Control Authority- the rights listed below

Article 15 – Right of access

You have the right to obtain from the data controller confirmation as to whether or notpersonal data concerning you are being processed and if so, to obtain access to the personal data and information regarding the processing

Article 16 – Right of rectification

The data subject has the right to obtain from the data controller the rectification of inaccurate personal data concerning him/her without undue delay. Taking into account the purposes of the processing, the data subject has the right to obtain the integration of incomplete personal data, including by providing a supplementary declaration.

Article 17 – Right to erasure (right to be forgotten) where the legal requirements are met

The data subject has the right to obtain from the data controller the erasure of personal data concerning him or her without undue delay, and the data controller is obliged to erase the personal data without undue delay.

Article 18 – Right to limitation of processing.

The data subject has the right to obtain from the data controller the restriction of processing when one of the following cases occurs:

Article 20 – Right to data portability – where the legal requirements are met

The data subject shall have the right to receive in a structured, commonly used and machine-readable format personal data concerning him or her that he or she has provided to a data controller and shall have the right to transmit those data to another data controller without hindrance from the controller to whom he or she has provided them.

When exercising his or her rights with regard to data portability under paragraph 1, the data subject has the right to obtain the direct transmission of personal data from one controller to another, if technically feasible.

Article 21 – Right to object

The data subject has the right to object at any time, on grounds relating to his or her particular situation, to the processing of personal data concerning him or her pursuant to Article 6(1)(e) or (f), including profiling on the basis of these provisions.

Article 22 – Right not to be subjected to automated decision-making, including profiling

The data subject has the right not to be subjected to a decision based solely on automated processing, including profiling, that produces legal effects concerning him or her or that significantly affects him or her in a similar way.

These rights may be exercised by writing to the Controller, at the contact details above and at the e-mail address  privacy@metaltronica.com